healer | 627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe
Size

940KB
MD5

b0fbf4fc8a0bfd3aba8dd234d6be5437
SHA1

d88e1363d7d491d7471085f983fd03cee5c93a0d
SHA256

627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497
SHA512

a1c06298c5ece84a558a8e48360f0fe7401895ea40eb8abf46889800ab43541b7722c534a5c2602b1151c1301fcc8c794b806eecbbe956db76d63a50713d3fd6
SSDEEP

24576:/yN2GpF6vNSZuzPUZ0XW50ummubMxU+4:KN2GpcvEozVAK3sX

Score

10^/10

healer redline diro lada discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lada

185.161.248.90:4125

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diro

185.161.248.90:4125

Attributes

auth_value
ae95bda0dd2e95169886a3a68138568b

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0032000000023b80-19.dat	healer
behavioral1/memory/2944-22-0x0000000000C40000-0x0000000000C4A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it035655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it035655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it035655.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it035655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it035655.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it035655.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/2716-2174-0x00000000027F0000-0x0000000002822000-memory.dmp	family_redline
behavioral1/files/0x000b000000023b78-2179.dat	family_redline
behavioral1/memory/3568-2187-0x00000000001F0000-0x000000000021E000-memory.dmp	family_redline
behavioral1/files/0x000a000000023b7e-2196.dat	family_redline
behavioral1/memory/1816-2198-0x0000000000ED0000-0x0000000000F00000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	jr275884.exe

Executes dropped EXE 6 IoCs

pid	Process
4788	ziKE5222.exe
4896	ziLd2612.exe
2944	it035655.exe
2716	jr275884.exe
3568	1.exe
1816	kp992633.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it035655.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziLd2612.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziKE5222.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1628	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	2716	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziKE5222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziLd2612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jr275884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kp992633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2944	it035655.exe
2944	it035655.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	it035655.exe
Token: SeDebugPrivilege	2716	jr275884.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4788	3704	627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe	83
PID 3704 wrote to memory of 4788	3704	627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe	83
PID 3704 wrote to memory of 4788	3704	627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe	83
PID 4788 wrote to memory of 4896	4788	ziKE5222.exe	84
PID 4788 wrote to memory of 4896	4788	ziKE5222.exe	84
PID 4788 wrote to memory of 4896	4788	ziKE5222.exe	84
PID 4896 wrote to memory of 2944	4896	ziLd2612.exe	86
PID 4896 wrote to memory of 2944	4896	ziLd2612.exe	86
PID 4896 wrote to memory of 2716	4896	ziLd2612.exe	93
PID 4896 wrote to memory of 2716	4896	ziLd2612.exe	93
PID 4896 wrote to memory of 2716	4896	ziLd2612.exe	93
PID 2716 wrote to memory of 3568	2716	jr275884.exe	94
PID 2716 wrote to memory of 3568	2716	jr275884.exe	94
PID 2716 wrote to memory of 3568	2716	jr275884.exe	94
PID 4788 wrote to memory of 1816	4788	ziKE5222.exe	98
PID 4788 wrote to memory of 1816	4788	ziKE5222.exe	98
PID 4788 wrote to memory of 1816	4788	ziKE5222.exe	98

C:\Users\Admin\AppData\Local\Temp\627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe
"C:\Users\Admin\AppData\Local\Temp\627090414aaa6f82c0500af380c2008a4c1de81bb311d82aa30694e682497497.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKE5222.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKE5222.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziLd2612.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziLd2612.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it035655.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it035655.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr275884.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr275884.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\Temp\1.exe
        
        "C:\Windows\Temp\1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 1368
        5⤵
        Program crash
        
        PID:4232
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp992633.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp992633.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2716 -ip 2716
1⤵
PID:2268

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKE5222.exe

Filesize
668KB

MD5
c10e4cfb3dee8b91c5e5d6c97113a0e3

SHA1
629bc1ac363ad1fdd7819c696f3adac27e6a0361

SHA256
b9eb4b4ad1bd2674f8f41c51418254ea69b4e39e32128b1618c2117089fb7c01

SHA512
fc9773c001c60cefa3d758e9bb3324066665d43e96b6d419601a22ec41723e702aea635423f1a684f77946c8c9532ef10242c53fdf9e4d956a080bd6c0d8ffbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp992633.exe

Filesize
168KB

MD5
aa8bb998c46f60bacf91f98f8d4d7b5c

SHA1
61c7e314d916035128849f85a29b34ac1fb482e0

SHA256
7e0252d52b7ff9e4466411941eb98cc220824be0f2eefdfe38e6b494f1176131

SHA512
3e1e8400351fbeedbb0f07370260dea23782c24924482d33c54f9db9659c858c2ee89f69b9a8256b091efec0ea33b09e408e0d218769ca3e2cbd013dd935dde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziLd2612.exe

Filesize
514KB

MD5
add271d6847dd0eed94f52e4f8fe855f

SHA1
b28dd58dde6e610002efe90fee910b1a76c6f9bf

SHA256
f8158711d0c05aca7a7df5bdeb442d81284c7a422d44ad09b6b989e3227540a4

SHA512
43fb6fea141101788cfd590df81f46d12b3c5e5873dc24bfc05d41f2779f8e783de05e702f29fab8ea1df84e83f4ac92b03e80a5c8239b699eac8826e69515d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it035655.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr275884.exe

Filesize
445KB

MD5
70bda1c68bbae25e5999a76abd734d22

SHA1
54b64659932379ca2e6c263692d3ea0f5479662a

SHA256
e92a115a192d12b7f47c4e3ee0e248fa1bb552f9ed5d827908de99029cd34660

SHA512
668d68f47058360ab19236603ce738afbcca734d8abfaa81641ffa02030df001d9e6c47c05d71034d54188aa9904da4e562cc632973180b20680a5c1bda0ce0d

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
03728fed675bcde5256342183b1d6f27

SHA1
d13eace7d3d92f93756504b274777cc269b222a2

SHA256
f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

SHA512
6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

Download Submit
memory/1816-2199-0x00000000030C0000-0x00000000030C6000-memory.dmp

Filesize
24KB

Download
memory/1816-2198-0x0000000000ED0000-0x0000000000F00000-memory.dmp

Filesize
192KB

Download
memory/2716-59-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-45-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-49-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-95-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-93-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-91-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-87-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-85-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-83-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-81-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-79-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-77-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-73-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-71-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-69-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-65-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-63-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-61-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-31-0x00000000024E0000-0x0000000002546000-memory.dmp

Filesize
408KB

Download
memory/2716-57-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-55-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-53-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-47-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-35-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-43-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-41-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-39-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-37-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-89-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-75-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-67-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-51-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-33-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-32-0x00000000024E0000-0x0000000002540000-memory.dmp

Filesize
384KB

Download
memory/2716-2174-0x00000000027F0000-0x0000000002822000-memory.dmp

Filesize
200KB

Download
memory/2716-29-0x0000000002360000-0x00000000023C8000-memory.dmp

Filesize
416KB

Download
memory/2716-30-0x0000000004E40000-0x00000000053E4000-memory.dmp

Filesize
5.6MB

Download
memory/2944-23-0x00007FFD47383000-0x00007FFD47385000-memory.dmp

Filesize
8KB

Download
memory/2944-22-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/2944-21-0x00007FFD47383000-0x00007FFD47385000-memory.dmp

Filesize
8KB

Download
memory/3568-2187-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/3568-2188-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/3568-2189-0x0000000005220000-0x0000000005838000-memory.dmp

Filesize
6.1MB

Download
memory/3568-2190-0x0000000004D10000-0x0000000004E1A000-memory.dmp

Filesize
1.0MB

Download
memory/3568-2191-0x0000000004A60000-0x0000000004A72000-memory.dmp

Filesize
72KB

Download
memory/3568-2192-0x0000000004C00000-0x0000000004C3C000-memory.dmp

Filesize
240KB

Download
memory/3568-2193-0x0000000004C40000-0x0000000004C8C000-memory.dmp

Filesize
304KB

Download